Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23807: Apache issued this CVE to indicate the correct versions of xerces-c, which included the fix for CVE-2018-1311. See the older CVE page for fix status.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | xerces-c | 0:3.1.1-10.amzn2.0.2 |
| Amazon Linux · 2 | xerces-c-debuginfo | 0:3.1.1-10.amzn2.0.2 |
| Amazon Linux · 2 | xerces-c-devel | 0:3.1.1-10.amzn2.0.2 |
| Amazon Linux · 2 | xerces-c-doc | 0:3.1.1-10.amzn2.0.2 |
Vulnerabilities 1
-
High 8.1
Apache Xerces C++: Use-after-free on external DTD scan
The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD pro…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-23807.html